Unified system for authentication and authorization

#The present invention relates generally to security of data processing systems. More particularly, this invention relates to a unified system interface for authentication and authorization.

#Traditionally operating systems, such as a UNIX operating system (OS), have a clear distinction between ordinary unprivileged users and the powerful super user with a “root” privilege. However, in order for a user to access and configure hardware additional privileges and rights are needed. This has been done in a number of often OS-specific ways. For example, some systems usually grant access to devices to a user if, and only if, the user is logged in at a local console. In contrast, other systems often relies on group membership, e.g. users in the “cdrom” group can access optical drives; users in the “plugdev” group can mount removable media; and so on.

#Traditionally, authentication and authorization are two distinctive processes that require separate processing entities. There has been a lack of an efficient way for authenticating and authorizing a user session for accessing a privileged application.

#The present invention is illustrated by way of example and not limitation in the figures of the accompanying drawings in which like references indicate similar elements.

#FIG. 1 is a block diagram illustrating a system having an authorization framework according to one embodiment.

#FIGS. 2A-2B are screenshots illustrating a graphical user interface for authenticating a user.

#In the following description, numerous details are set forth to provide a more thorough explanation of the embodiments of the present invention. It will be apparent, however, to one skilled in the art, that embodiments of the present invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring embodiments of the present invention.

#Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. The appearances of the phrase “in one embodiment” in various places in the specification do not necessarily all refer to the same embodiment.

#According to some embodiments, an interface is provided for privileged or trusted applications to access an authorization framework in determining whether a particular client (e.g., untrusted application) communicating with the privileged/trusted application can access a service provided by the privileged/trusted application. The actual decision-making process (e.g., authorization and/or authentication) is hidden from the privileged/trusted application. In authorizing a client, one implementation could read authorization policy from a local disk and another implementation could read authorization policy from a trusted directory server over a network, dependent upon a specific configuration. In addition, an authentication interface is provided to allow a user to gain temporary authorization by authenticating the user itself or as an administrator or a super user. Thus, the authorization framework is implemented combining the functionalities of authorization and authentication in a unified application programming interface (API), which is may be implemented as an inter-process call (IPC) or system bus message mechanism (e.g., D-bus or UNIX pipes).